A Dynamic Barriers Implementation inBayesian-Based Bow tie Diagrams for Risk

AnalysisAhmed Badreddine

LARODECInstitut Superieur de Gestion Tunis

41 Avenue de la liberte, 2000 Le Bardo, Tunisie.Email: badreddine.ahmed@hotmail.com

Nahla Ben AmorLARODEC

Institut Superieur de Gestion Tunis41 Avenue de la liberte, 2000 Le Bardo, Tunisie.

Email: nahla.benamor@gmx.fr

Abstract—Bow tie diagrams have become popular methods inrisk analysis and safety management. This tool describes graph-ically, in the same scheme, the whole scenario of an identifiedrisk and its respective preventive and protective barriers. Themajor problem with bow tie diagrams is that they remain limitedby their technical level and by their restriction to a graphicalrepresentation of different scenario without any consideration tothe dynamic aspect of real systems. Recently we have proposeda new Bayesian approach to construct bow tie diagrams forrisk analysis [1]. This approach learns the bow tie structurefrom real data and improves them by adding a new numericalcomponent allowing us to model in a more realistic manner thesystem behavior. In this paper we propose to extend this approachby adding the barriers implementation in order to constructthe whole bow ties. To this end we will use the numericalcomponent, previously defined in the learning phase, and theanalytic hierarchical process (AHP).

Index Terms—Bow tie diagrams, Risk analysis, Preventivebarriers, Protective barriers, Propagation algorithms, Analytichierarchical process.

I. INTRODUCTION

Since 2003, the bow tie diagrams [4] have been used asa tool for risk analysis in several industrial fields such asenergetic, automobile etc. The success of bow tie diagramscan be explained by the fact that the whole scenario for eachidentified risk also called top event (TE) is clearly representedvia two parts: the first corresponds to a fault tree defining allpossible causes leading to the TE and the second representsan event tree to reach all possible consequences of the TE. Inaddition, bow tie diagrams allow to define in the same schemepreventive barriers to limit the occurrence of the TE andprotective barriers to reduce the severity of its consequences.In spite, its widely use in many organizations, this methodremains limited by its technical level and by the graphicalpresentation of different scenarios without any suggestionabout optimal decisions regarding the expected objectives.

In fact, in the literature few researches have been carried outto deal with the building phase of bow tie diagrams and theirexploitation in the decision problems. Indeed, we have noticedthat the researchers are usually interested in its quantificationphase [8] [9], while the construction one is always dedicated

to the experts. Recently, we have proposed a new Bayesianapproach to learn both the fault tree and the event tree fromreal data and to improve them by adding a new numericalcomponents allowing us to model, in a more realistic manner,the system behavior [1].

In this paper we go one step further regarding this approachby proposing a dynamic implementation of protective andpreventive barriers. In fact, the choice of the appropriatebarriers is not an easy task, since it depends on many criteriasuch as effectiveness, reliability, availability and cost [4].Thus their definition from experts experience without anyconsideration of real data, as done in actual applications, mayaffect their quality since it seems unrealistic to suggest staticrecommendations in real dynamic systems. Thus our idea is tobenefit from the numerical component, that we have added tobow ties [1], in order to allow experts interact with the systemin a real time via a muticriteria approach, namely the analytichierarchical process (AHP).

The remainder of this paper is organized as follows: Section2 presents a brief recall on the bow tie diagrams analysis.Section 3 presents the principles of the analytic hierarchicalprocess (AHP). Section 4 is dedicated to the protective andpreventive barriers implementation. Finally section 5 presentsan illustrative example of our method in the petroleum field.

II. A BRIEF RECALL ON THE BOW TIE DIAGRAMSANALYSIS

The bow tie diagrams are a very popular and diffusedprobabilistic technique developed by Petroleum companies fordependability modeling and evaluation of large safety-criticalsystems [4]. The principle of this technique is to build foreach identified risk Ri (also called top event (TE)) a bow tierepresenting its whole scenario on the basis of two parts, asshown in figure 1:

• the first part corresponds to the left part of the schemewhich represents a fault tree (FT ) defining all possiblecauses leading to the (TE). These causes can be classifiedinto two kinds: The first are the initiator events (IE)which are the principal causes of the TE, and the second

are the undesired or critical events (IndE and CE) whichare the causes of the IE. The construction of the leftpart proceeds in top down manner (from TE to IndEand CE). The relationships between events and causesare represented by means of logical AND and OR gates.

• The second part corresponds to the right part of thescheme which represents an event tree (ET ) to reach allpossible consequences of the TE. These consequencescan be classified into three kinds: second events (SE)which are the principal consequences of the TE, danger-ous effects (DE) which are the dangerous consequencesof the SE and finally majors events (ME) of each DE.The construction of the event tree proceeds as the faulttree i.e. in top down manner.

The bow tie diagrams also allows the definition, in the samescheme, of some preventive barriers to limit the occurrence ofTE and also of protective barriers to reduce the severity of itsconsequences. These barriers can be classified as active if theyrequire a source of energy or a request (automatic or manualaction) to fulfill their function (e.g. a safety valve, an alarmetc.) or passive if they do not need a source of energy nor arequest to fulfill their function (e.g. a procedure, a retentiondike, a firewall etc.).

Fig. 1. A bow tie diagram model

Recently [1], we have depicted some weaknesses relatedto such diagrams essentially lied to their technical level, andproposed to overcome them by learning them from real data.More precisely, we have proposed to consider bow ties asprobabilistic graphs, denoted by BT , having:

• a tree-structured graphical component T on a set of nnodes V = {X1, .., Xn} s.t. each node Xi representsan event (e.g. IE, CE, SE etc.). To construct thiscomponent we use the standard tree building algorithmproposed by Chow and Liu [2]. Thus, our idea is to runit twice in order to learn the FT and the ET structures(denoted by TFT and TET ) separately from two trainingsets: the first, denoted by TSFT , is relative to the causesleading to TE and the second, denoted by TSET , isrelative to its consequences. In these two phases TE willbe considered as the root. Then we will orient the resulted

undirected trees semantically using the fact that events inTFT are causes of TE i.e. arcs in TFT will be directedtowards TE and events in TET are its consequences i.e.arcs in TET will be backwards TE.

• a numerical component allowing us in one hand to char-acterize the impact of different causes on the top eventTE and in the other hand to study its repercussion whileconsidering its severity and those of its consequences.

– Regarding the first part, we propose to use aBayesian approach based on informative priors byassigning to each node Xi in FT a probabilitydistribution P (Xi = k | Pa(Xi) = j) (i.e. theprobability that Xi is equal to k knowing that itsparents denoted by Pa(Xi) take the value j). Thesevalues will be computed from TSFT using themaximum a posterior (MAP) estimate expressed by:

P (Xi = k | Pa(Xi) = j) =Nijk + αijk∑k Nijk + αijk

(1)

where Nijk is the number of instances in the trainingset TSFT where Xi = k and Pa(Xi) = j occurconjointly and αijk is a Dirichlet prior having asimple interpretation in terms of pseudo counts i.e.we suppose that we saw the value k of Xi for eachvalue j of Pa(Xi) αijk times. This value prevents usfrom declaring that the event (Xi = k, Pai = j) isimpossible just because it was not seen in the trainingset (which is the case of the standard maximumlikelihood (ML) estimate). Thus if αijk > 0 thenP (Xi = k | Pa(Xi) = j) will not be equal to 0. Inwhat follows, we will use uniform prior i.e. ∀i, j, kαijk = 1.

– To compute the severity degrees relative to ET , weassign to each node Xi in ET (except ME), a vectorSi s.t. Si[j] is the severity of Xi w.r.t to its childrenXj . Here we will use TSET by considering thatSi[j] = P (Xj = T | Xi = T ). To compute thisvalue we use Bayes theorem as follows:

Si[j] = P (Xj = T | Xi = T ) =Nij

Ni(2)

where Nij is the number of instances in TSET whereXi = T and Xj = T occur conjointly and Ni is thenumber of instances in TSET where Xi = T .

III. PRINCIPLES OF ANALYTIC HIERARCHICAL PROCESS(AHP)

In the literature we can distinguish a panoply of muticriteriaapproaches such as weighting methods, outranking methodsand interactive methods. To select the appropriate barrierswe propose to use the standard weighting method, which isthe analytic hierarchical process (AHP) [12] since it can beeasily adapted to our requirements. The AHP is a tool forquantifying decision-making processes with multiple criteria.Its helps analysts to organize the critical aspects of a problemby decomposing it into a multi-level hierarchical structure

corresponding to a tree structure where the first level (i.eroot) corresponds to the objectives, the last one (i.e theleaves) corresponds to the alternatives (i.e possible solutions),and the intermediate levels between the root and the leavescorrespond to the different criteria and their sub-criteria. Foreach level of this tree (expect the root) we should defineone or several decision matrices (DM) based on pair-wisecomparison. In other terms for any two elements ai and aj

(which can be criteria or alternatives) we should define anintensity importance aij in the context of any elements of theprevious level. This value can be depicted from the Saaty scalemeasurement [12] given in table I.

TABLE ISAATYS SCALE OF MEASUREMENT.

Intensity of importance Significance1 Equal importance3 Moderate importance of one over another5 Essential or strong importance7 Very strong importance9 Extreme importance

2, 4, 6, 8 Intermediate values between the two adjacent judgments

Golden et al. [5] represent the mathematical concept of AHPas follows. First of all, a Decision Matrix (DM) is constructedusing pairwise comparisons of n relevant criteria. The positive,reciprocal matrices DM= aij is thus defined as

a11 a12 ... a1n

a21 a22 ... a2n

a31 a32 ... a3n

. . . .

. . . .

. . . .an1 an2 ... ann

=

1 W1W2

.. W1Wn

W2W1

1 .. W2Wn

. . . .

. . . .

. . . .Wn

W1

Wn

W3.. 1

(3)

where aij is the importance between the element i and j,consequently it represents a ratio between the relative weightbetween the element i (Wi) and j (Wj).

Then we should express the relative importance betweenthe different criteria by eigenvector normalized to 1. Thus weobtain a new matrix B expressed as follows:

B =

1∑ ni=1 ai1

a12∑ ni=1 ai2

a13∑ ni=1 ai3

... a1n∑ ni=1 ain

a21∑ ni=1 ai1

1∑ ni=1 ai2

a23∑ ni=1 ai3

... a2n∑ ni=1 ain

. . . .

. . . .

. . . .an1∑ ni=1 ai1

an2∑ ni=1 ai2

an3∑ ni=1 ai3

... 1∑ ni=1 ain

(4)

Then the relative weight of an element i in the column j ofthe matrix B is computed by the following equation

W ji =

[1∑ n

i=1 aij

]∗

a1j

a2j

a3j

.

.

.anj

(5)

Once Wij is defined , we synthesis the priorities by evaluat-ing the global score relative to each alternatives , by appliyingthe following equation :

Wi =1n

n∑i=1

Pij (6)

Finally to ensure the coherence of the global hierarchieswe have first to evaluate the consistency index CI, defined bysaaty [12] as follows:

CI =TCmax − K

K − 1(7)

where k is the number of compared elements and TC themaximum eigenvalue of the matrix.

Then we have to calculate the consistency ratio defined bythe following equation:

CR =CI

RI(8)

Where RI is the random index value defined according tothe number of criteria defined as shown in table table II [12].

TABLE IITABLE OF RANDOM INDEX

Number of criteria RI2 03 0.584 0.95 1.126 1.247 1.458 1.499 1.51

Values of CR <= 0.1 are typically considered acceptable.If a decision matrix has a CR larger than 0.1, its judgmentsshould be revised.

We explain now how to integrate this phase in the effectiveimplementation of preventive and protective barriers.

IV. DYNAMIC APPROACH TO BARRIERS IMPLEMENTATION

As indicated in section II, the choice of barriers in classicalbow ties is done by experts in a static way which is incompat-ible with the dynamicity of real problems. Thus, we proposehere to avoid this problem by using the ability of probabilisticgraphs to compute the impact of some observations on theremaining nodes in a dynamic way. In other terms, once thebow tie is constructed (structure and parameters), we can atany moment observe the behavior of some events, from the

real system, and study their impact on TE in order to see thereal probability relative to its release and propose appropriateprotective and preventive barriers. This choice is, obviously,constrained by some criteria such as effectiveness, reliability,availability and cost. For instance, some interventions can belimited due to the unavailability of some resources (e.g. labor)or even impossible (e.g. barriers to stop or reduce naturaldisasters). To overcome this problem, we propose to use theAHP as a muticriteria approach. In what follows, we detailour algorithms regarding the implementation of preventive andprotective barriers, respectively.

A. Preventive barriers implementation

The first step of this phase is to study the impact ofobservations lied to the nodes in the FT (referred to byE) on the top event TE i.e. we are interested by the valueP (TE = T | E). This can be ensured in a polynomial wayby applying the centralized version of Pearl’s propagationalgorithm in polytrees [10], [11]. In this algorithm the impactof each new piece of evidence is viewed as a perturbation thatpropagates via a two message passing between neighboringvariables, namely a collect-evidence pass where messages arepassed toward a particular node in FT , called pivot, and adistribute-evidence pass where messages are passed from thepivot to the rest of the nodes in FT . In our case we willconsider TE as the pivot.

Once this computation performed, we will select the bestcombination of interventions that allows us to reduce theprobability of occurence of the TE. Let I be the set of allpossible combinations of interventions on events relative toFT . Note that some combinations are meaningless due to theparticular form of FT where all relations are tail-to-head (i.e.serial pattern) [10]. Indeed, if we consider the following graphX3 → X2 → X1 ← X4 then any intervention on X3 inorder to reduce X1 will be useless if we will intervene onX2 since X1 and X3 are blocked by X2 due to the fact thatthe connection through X2 is tail-to-head. This means thatI = {X2, X3, X4, X2X4, X3X4}. This set will be used inorder to find the most effective interventions to perform bytesting the impact of each combination on the probability ofTE i.e. ∀Ii ∈ I we will compute P (TE = T | Ii = T ). Sucha computation can also be done via the centralized version ofPearl’s propagation algorithm.

Finally, the choice of appropriate preventive barriers withinthe ones relative to the best combination of interventions willbe done on the basis of the AHP method. In fact, we proposea three levels hierarchical structure as shown in figure 2 withthe objective to select the appropriate preventive barriers asa root. In the second level, we propose to use the mostcommon criteria relative to the selection of the barriers [4] (i.eeffectiveness, reliability, availability and cost), then the thirdand last level will concerns to the possible preventive barriers(P1.. Pn). In what follows, we will use a function AHP (PB:a set of possible barriers, DM: a set of the required decisionmatrices) returning the set of barriers sorted by priority.

Fig. 2. The hierarchical model to select the appropriate preventive barriers

The global preventive barriers implementation algorithm canbe outlined as follows:

Algorithm 1: Preventive barriers implementation

Data: TFT , E

Result: P ∗: proposed preventive barriers sorted by prioritybegin

1. current ← P (TE = T | E)2. Let I be the set of possible combination of interven-tions;3. % Select the best combinationvmax ← currentforeach Ii ∈ I do

if P (TE = T | Ii = T ) < vmax thenvmax ← P (TE = T | Ii = T )Best ← Ii

4. Let PB be the set of preventive barriers relative toevents in Best5. Let DM be the set of the decision matrices relativeto different criteria and their alternatives.6. % Select the appropriate preventive barriersP∗ ← AHP (PB,DM)

end

B. Protective barriers implementation

To select the appropriate protective barriers (Pr∗) to im-plement on the system, we can simply use the severity vectorvalues (S) already computed for each node in ET via equation2. More precisely, we propose to select the events havinga higher severity degrees values w.r.t to its children. Thisselection is based on a threshold value ε defined by expertsas a reference value. Then similarly, to the implementation ofpreventive barriers, we will use the AHP in order to implementthe protective ones, following the same hierarchy of figure 2by just replacing the objective by protective barriers selectionand the alternatives by the proposed protective barriers (Pri).

This algorithm is outlined as follows:

Algorithm 2: Protective barriers implementation

Data: TET ,S, ε

Result: Pr∗: proposed protective barriers sorted by prioritybegin

1. % Seclect the critical eventsforeach Si ∈ S do

foreach Sij ∈ Si doif Si[j] > ε then

D ← D ∪ {Xi, Xj}

2.Let PBr be the set of preventive barriers relative toeach couple of events in D.3. Let DM2 be the set of the decision matrices betweenthe different criteria and their alternatives.4. %Select the appropriate protective barriersPr∗ ← AHP (PBr,DM2)

end

V. ILLUSTRATIVE EXAMPLE

This section illustrates our method via an example releasedin TOTAL TUNISIA company. In this example we illustrate aunique risk relative to a major fire and explosion on tankertruck carrying hydrocarbon (TE). To construct the relativebow tie we have identified six events leading to TE (i.e.hydrocarbon gas leak (HGL), and source of ignition closeto road (SI) tank valve failure (TV F ), exhaust failure (EF),and construction site close to the truck parking (CTP )) andnine events representing its consequences (i.e pool fire(PF ),thermal effects (THE), toxic effects (TO), production processin stop (PPS), thermal damage to persons (TDP ), damageto the other trucks (DT ), toxic damage to persons (TODP ),damage to environment (DE) and late delivery (LD)). Thetraining set relative to causes (resp. consequences) TSFT

(resp. TSET ) is given in table III (resp. table IV) where value1 means false and 2 true.

A. Learning bow tie structure and parametersWhen applying the building algorithm described in [1] we

obtain the fault tree (FT ) and the event tree (ET ) illustratedby figures 3 and 4 respectively. This bow tie was validated byexperts in Total Tunisie since it corresponds to the one theyhave already proposed.

Fig. 3. Fault tree structure

The numerical component relative to the FT is given bytable V and severity degrees relative to ET are given in tableVI.

TABLE IIITRAINING SET RELATIVE TO CAUSES OF A MAJOR FIRE AND EXPLOSION

ON TANKER TRUCK CARRYING HYDROCARBON

TE EF CTP TV F HGL SI TE EF CTP TV F HGL SI1 1 1 1 1 1 1 1 1 1 1 11 1 2 1 2 1 1 1 1 1 1 11 2 2 1 2 2 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 11 2 1 1 1 1 1 2 1 1 1 21 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 11 1 2 1 2 1 2 1 1 2 2 21 1 1 1 1 1 2 2 1 1 1 21 1 1 1 1 1 2 2 1 2 2 21 1 1 1 1 1 2 2 2 1 2 21 1 1 1 1 1 2 2 2 1 2 21 1 1 1 1 1 2 2 2 1 2 21 1 1 1 1 1 2 1 2 1 2 21 1 1 1 1 1 2 1 2 1 2 11 1 1 2 2 1 2 2 1 1 1 22 2 2 1 2 2 1 1 1 1 1 12 2 1 2 2 2 1 1 1 1 1 12 2 2 1 2 2 1 1 1 1 1 12 1 2 2 2 1 1 1 1 1 1 12 1 2 2 2 2 1 1 1 1 1 11 1 1 1 1 1 1 1 2 2 2 11 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 1

Fig. 4. Event tree structure

B. Preventive barriers implementation

In this case study, we suppose that no observations areavailable, thus the first step in algorithm 1 is to calculatethe P (TE = T | E = ∅) which is equal to 0.2977, in thenext step we consider that we can intervene on all eventsexcept (CTP ) which is not controllable since we cannot stopconstructions close to the truck parking, and by consideringthe bow tie structure illustrated in figure 3, the possible com-binations to minimize the frequency are I1 = {TV F}, I2 ={EF}, I3 = {HGL}, I4 = {SI}, I5 = {TV F,EF}, I6 ={TV F, SI}, I7 = {EF,HGL}, I8 = {HGL,SI}. On thethird step, the optimal combination I∗= {SI, HGL} is selectedsince it decreases occurrence of TE from 0.2977 to 0.0294(see table VII). Regarding this situation we can choose inthe fourth step the following preventive barriers: Educationand Training Task to deal with HGL (P1), Fire simulation(P2), Prohibition to park the trucks close the site after loading(P3), Periodic preventive to minimize (SI) and (HGL) ((P4)).

TABLE IVTRAINING SET RELATIVE TO CONSEQUENCES OF A MAJOR FIRE AND

EXPLOSION ON TANKER TRUCK CARRYING HYDROCARBON

TE LD DE TODP DT TDP PPS TO PF THE1 2 2 1 2 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 2 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 2 1 1 1 1 2 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 2 2 1 1 2 12 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 21 1 1 1 1 1 1 1 1 11 1 2 2 1 1 1 2 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 2 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 2 2 2 2 2 2 2 2 12 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 2 2 2 2 2 2 2 2 22 1 1 1 1 1 1 1 1 12 2 2 2 2 2 2 2 2 21 1 2 2 1 1 1 2 1 11 1 1 1 1 2 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 2 1 1 1 1 2 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1

To select the appropriate ones we apply in the fifth step theanalytic hierarchical process (AHP) as indicated in section IV.Thus first we have to define the relative criteria’s decisionmatrices on the basis of saaty scale measurement (see table I)as illustrated in figure VIII.

From table VIII, we can note that for instance the effective-ness has a moderate importance than the availability, and thereliability has a strong importance than the cost etc. On thebasis of these values, we define the relative weight concerning

TABLE VNUMERICAL COMPONENT RELATIVE TO FT

a, b SI, HGL SI, HGL SI, HGL SI, HGL

P (TE = T | a, b) 0.8462 0.375 0.6 0.0294

a, b EF, CTP EF, CTP EF, CTP EF, CTP

P (SI = T | a, b) 0.875 0.333 0.75 0.0571

a TVF TV F

P (HGL = T | a) 0.766 0.111

P (EF ) 0.7593

P (CTP ) 0.7407

P (TV F ) 0.8519

TABLE VISEVERITY DEGREES RELATIVE TO ET

− TE PF THE TO PPSTE − − − − −PF 0.8824 − − − −

THE − 0.9375 − − −TO − 0.9375 − − −

PPS − 0.9375 − − −TDP − − 0.9444 − −DT − − 0.9444 − −

TODP − − − 0.9474 −DE − − − 0.9474 −LD − − − − 0.9474

TABLE VIIPROPAGATION RESULTS

Ii P (TE = 2 | Ii = 2)TV F 0.2669EF 0.2130

HGL 0.1927TV F, EF 0.1808TV F, SI 0.1103EF, HGL 0.1029SI, HGL 0.0294

TABLE VIIICRITERIA’S DECISION MATRICES

− Effectiveness Reliability Availability CostEffectiveness 1 2 3 4

Reliability 0.5 1 4 6Availability 0.33 0.25 1 4

Cost 0.25 0.16 0.25 1

each criteria, these weights are illustrated in table IX.

TABLE IXRELATIVE WEIGHT CONCERNING EACH CRITERIA

Preventive barriers WeightsEffectiveness 0, 427Reliability 0, 342Availability 0, 159Cost 0, 072

Thus, we can conclude that the effectiveness is the most im-portant criteria followed by the availability, then the reliabilityand finally the cost. Once the criteria’s weights are defined,we compare all the alternatives according to each criteria. Therelative decision matrices are represented in table X.

TABLE XPREVENTIVE BARRIER’S DECISION MATRICES

effectiveness DM reliability DM− P1 P2 P3 P4 P1 P2 P3 P4P1 1 5 3 2 1 5 4 2P2 0.2 1 0.33 0.25 0.2 1 0.5 0.33P3 0.33 3 1 0.5 0.25 2 1 2P4 0.5 4 2 1 0.5 3 0.5 1

availability DM cost DM− P1 P2 P3 P4 P1 P2 P3 P4P1 1 4 7 2 1 3 0.33 1P2 0.25 1 4 0.33 0.33 1 0.2 0.33P3 0.142 0.25 1 2 3 5 1 3P4 0.5 3 0.5 1 1 3 0.333 1

Then on the basis of these values, table XI representsthe different barrier’s weights according to each criteria, forinstance, regarding the criteria j=effectiveness, the barrier i=P1 is the most important (W j

i = 0, 47), followed by i=P4

(W ji = 0, 284), then i=P3 (W j

i = 0, 171) and finally i=P2

(W ji = 0, 075).

TABLE XIRELATIVE WEIGHT CONCERNING EACH CRITERIA

Pi Effectiveness Reliability Availability Cost Weights(0, 427) (0, 342) (0, 159) (0, 072)

P1 0, 47 0, 502 0, 487 0, 2 0.465P2 0, 075 0, 087 0, 158 0, 09 0.096P3 0, 171 0, 212 0, 14 0.51 0.206P4 0, 284 0, 199 0, 215 0.2 0.233

The column Weights represents the relative weight Wi toeach barrier Pi, thus we can conclude that the most interestingbarrier is Education and Training Task to deal with HGL ,followed by Periodic preventive to minimize (SI) and (HGL),then Prohibition to park the trucks close the site after loadingand finally Fire simulation . The choice between these barrierswill be done by experts.

C. Protective barriers implementation

To implement the appropriate protective barriers, the expertset the threshold value ε = 0.8. Thus on the basis of tableVI the algorithm 2 defines first the following couple of eventsD= { {TE,PF}, {PF,THE}, {PF,TO}, {PF,PPS}, {THE,TDP},{THE,DT}, {TO,TODP}, {TO,DE}, {PPS,LD}}. Regardingthis situation we can choose on the next step the followingprotective barriers: a fix or tractable canal to prevent incidentalong the site (Pr1), Blast protection window film (Pr2),Setting up equipments to limit the thermal effects (Pr3), andSetting up equipments to limit the toxic effects (Pr4). In thefourth step we apply the analytic hierarchical process in orderto select the appropriate protective barriers. In this case ofstudy we suppose that the protective barriers and preventiveones have identical criteria’s weights (see table IX), thus wecompare directly the protective barriers according to eachcriteria, The relative decision matrices are represented in tableXII.

Then on the basis of these values, table XIII representsthe different barrier’s weights according to each criteria. Thecolumn Weights represents the relative weight Wi to each

TABLE XIIPROTECTIVE BARRIER’S DECISION MATRICES

effectiveness DM reliability DM− Pr1 Pr2 Pr3 Pr4 Pr1 Pr2 Pr3 Pr4

Pr1 1 5 0.5 0.2 1 4 5 5Pr2 0.2 1 0.2 0.125 0.25 1 4 4Pr3 2 5 1 5 0.2 25 1 1Pr4 5 8 0.2 1 0.2 0.25 1 1

availability DM cost DM− Pr1 Pr2 Pr3 Pr1 Pr1 Pr2 Pr3 Pr4

Pr1 1 0.33 0.2 0.2 1 1 3 3Pr2 3 1 0.33 0.33 1 1 2 2Pr3 5 3 1 1 0.33 0.5 1 1Pr4 5 3 1 1 0.33 0.5 1 1

barriers Pri, thus we can conclude that the most importantbarriers is a fix or tractable canal to prevent incident along thesite , followed by setting up equipments to limit the thermaleffects, then setting up equipments to limit the toxic effectsand finally blast protection window film.

The choice between these barriers will be done by experts.

TABLE XIIIRELATIVE WEIGHT CONCERNING EACH CRITERIA

Pri Effectiveness Reliability Availability Cost Weights(0, 427) (0, 342) (0, 159) (0, 072)

Pr1 0, 169 0, 56 0, 068 0.3931 0.319Pr2 0, 050 0.253 0, 156 0, 319 0.165Pr3 0, 455 0, 087 0, 388 0, 144 0.296Pr4 0, 326 0, 1 0, 388 0, 144 0.22

VI. CONCLUSION

This paper proposes a dynamic way to implement preventiveand protective barriers in bow tie diagrams. Our proposalis based on a statistical computation allowing us to have arealistic view of the system behavior and on the analytichierarchical process (AHP) in order to take into considerationdifferent selection criteria. This approach extends the bowtie building algorithm recently proposed in [1] and allowsus to overcome the problem lied to the static selection ofpreventive and protective barriers. As future work, we proposeto implement a new approach to measure the effectiveness ofthe proposed barriers, to deal with we propose to implementa global monitoring plan based on several tools such as: cus-tomers satisfaction, audits, controls and performance indicatorsof processes.

ACKNOWLEDGMENT:

The authors would like to thank Total Tunisie for thevaluable assistance.

REFERENCES

[1] A.Badreddine, N. Ben Amor:“ A new approach to construct optimalbow tie diagrams for risk analysis, 23nd International Conference onIndustrial, Engineering and other Applications of Applied IntelligenceSystems, Springer-Verlag, juin 2010.

[2] C.K. Chow, C.N. Liu: “Approximating discrete probability distributionswith dependence trees,” IEEE Transactions on Information Theory, N14(3), pp. 462-467, 1968.

[3] T.H. Cormen, C. E. Leiserson, R.R. Rivest: Introduction to Algorithms.Cambridge, MA: MIT Press, 1990.

[4] J.C. Couronneau, A. Tripathi: “Implementation of the new approach ofrisk analysis in france ,” International Petroleum Conference, Bratislava,2003.

[5] B.L. Golden, E.A. Wasil, P.T. Harker: The Analytic Hierarchy Process:Application and Studies. Springer Verlag, Berlin. 1989.

[6] G. Cooper E. Hersovits: “A bayesian method for the induction ofprobabilistic networks from data,” Maching Learning, N9, pp.309-347,1992.

[7] N. Friedman: “The Bayesian structural EM algorithm,” Proc. of the 14thConference on Uncertainty in Artificial Intelligence, pp. 129-138, SanFrancisco, July 1998.

[8] D. Kurowicka, R. Cooke, L. Goossens, B. Ale: “Expert judgment studyfor placement ladder bowtie,” Safety Science, N46, pp.921-934, 2008.

[9] S. Markowski, M. Sam Mannan, A. Bigoszewska:“Fuzzy logic for processsafety analysis,” Journal of Loss Prevention in the Process Industries,N22(6), pp.1-8, 2009.

[10] J. Pearl:“Fusion propagation and structuring in belief networks,” Artifi-cial Intelligence, N29, pp.241288, 1986.

[11] M. A. Poet and R. D. Shachter, Fusion and propagation with multipleobservations in beleif networks, Artificial Intelligence, Vol 48, 299-318,1991.

[12] T.L. Saaty: The Analytic Hierarchy Process. McGraw-Hill, New York(1980).

[13] P. Spirtes, C. Glymour, R. Scheines: Causation, Prediction, and Search.The MIT Press, 2 edition (2000).